neural-hash-collider VS owasp-mstg

That assumes the hash is base 26 which would be fun, but most hashing systems including NeuralHash are hexadecimal. NeuralHash also outputs 24 character hashes so there are 1624 possible NeuralHashes. However all of that ignores that NeuralHash is designed so that visually similar images will return the same hash on purpose. You can even provide two images of your choosing to this library and it will make them collide https://github.com/anishathalye/neural-hash-collider

This is incorrect.

The images in this link [1], are completely different. One is a cat, one is a dog. Same hash produced for both.

[1] https://github.com/anishathalye/neural-hash-collider

And here: https://github.com/anishathalye/neural-hash-collider

Also, Apple’s NeuralHash is rather prone to hash collisions, i.e. false positives, so you should absolutely expect at least some of your on-device pics to be viewed by unauthorized Apple/government personell.

I found a more detailed explanation of it: https://github.com/julepka/owasp-mstg/blob/master/Document/0...

> Generally, you should provide compiled code with as little explanation as possible. Some metadata, such as debugging information, line numbers, and descriptive function or method names, make the binary or bytecode easier for the reverse engineer to understand, but these aren't needed in a release build and can therefore be safely omitted without impacting the app's functionality.

I'm not a big fan of the reasoning, as it's security through obscurity. Which is not the worst tradeoff, but these days it just makes public bug bounties (and other public auditing) end up being less of an interesting prospect for improving security.